QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Inconsistent Permission Checks Allow Update Time Modification for Non-Updatable Pools

huntoor

Summary

UpdateWeightRunner allows pool managers to modify last update time through InitialisePoolLastRunTime() even when pools lack MASK_POOL_PERFORM_UPDATE permission, creating an illogical permission state.

Vulnerability Details

Current implementation only checks MASK_POOL_OWNER_UPDATES:

if (poolRegistryEntry & MASK_POOL_OWNER_UPDATES > 0) {
require(msg.sender == poolRuleSettings[_poolAddress].poolManager, "ONLYMANAGER");
}

This allows:

  1. Pool with flags = 8 (MASK_POOL_OWNER_UPDATES) but not 1 (MASK_POOL_PERFORM_UPDATE)

  2. Manager can modify last run time

  3. Pool cannot execute performUpdate() due to missing permission

Impact

  • Inconsistent pool state

  • Potential manipulation of timing mechanics

Tools Used

Manual Review

Recommendations

Add MASK_POOL_PERFORM_UPDATE check:

if (poolRegistryEntry & MASK_POOL_OWNER_UPDATES > 0) {
require(poolRegistryEntry & MASK_POOL_PERFORM_UPDATE > 0, "POOL_CANNOT_UPDATE");
require(msg.sender == poolRuleSettings[_poolAddress].poolManager, "ONLYMANAGER");
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!